Topic starter
17/08/2026 4:39 pm
TL;DR: Teleport finds that static credentials, fragmented identity tooling, and human-centred access models no longer match modern infrastructure, where most breaches begin with stolen or misused credentials and non-human identities outnumber people by orders of magnitude. Resilient access now depends on cryptographic identity, short-lived privileges, and unified governance across human and machine actors.
Editorial analysis by NHI Mgmt Group, based on content published by Teleport: “The Missing Link Between Infrastructure Resiliency and High-Velocity Engineering”.
By the numbers:
- More than 70% of breaches begin with stolen or misused credentials, including compromised logins and hardcoded API keys.
Key questions
Q: Why do static credentials create more risk in hybrid infrastructure?
A: Static credentials tend to spread across sites, survive role changes, and remain valid long after the original need has passed.
Q: When should organisations prioritise unified identity intelligence?
A: Prioritise it when identity data is fragmented across multiple tools, when access reviews take too long to trust, or when service accounts and AI agents are expanding faster than governance can keep up.
Q: What breaks when infrastructure still depends on long-lived secrets?
A: Long-lived secrets break the assumption that access can be safely reviewed after provisioning.
Practitioner guidance
- Inventory all static credentials Identify passwords, secrets, SSH keys, and hardcoded API keys across repositories, infrastructure platforms, and operational tooling, then classify which ones are still carrying standing access.
- Unify governance for human and machine access Create a single policy view for users, workloads, APIs, and privileged infrastructure access so teams are not stitching together separate control planes for each actor type.
- Shift high-risk access to short-lived issuance Replace durable privileges with just-in-time access where task scope, duration, and approval logic are explicit for infrastructure operations that cannot tolerate standing credentials.
Bottom line: The article argues that infrastructure resiliency now depends on moving beyond static credentials and siloed identity tools.
What's in the full article
Teleport's full blog post covers the operational detail this post intentionally leaves for the source:
- The webinar discussion on why identity attacks now dominate modern infrastructure breach patterns
- Ev Kontsevoy and Jack Poller's examples of how hybrid and multi-cloud complexity drives operational overhead
- The practical four-step getting-started sequence for cluster-sized trust computing
- The access-flow examples showing how self-service identity can support developer velocity
👉 Read Teleport's analysis of infrastructure identity and resilient access →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
17/08/2026 4:44 pm
Static credentials are now an identity governance liability, not just an authentication weakness. The article’s central point is that passwords, secrets, SSH keys, and API keys fail when infrastructure becomes distributed and machine-heavy. Their persistence creates an attack window that scales with environment size, not with business need. Practitioners should treat long-lived credentials as a governance defect in infrastructure identity programmes.
A few things that frame the scale:
- Organisations that rely heavily on static credentials reported a 20-percentage-point increase in security incidents compared with those with low reliance, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What should teams do when AI workloads and Kubernetes clusters share the same access estate?
A: Teams should treat AI workloads and Kubernetes clusters as first-class infrastructure identities and apply the same governance model across both. That means defining ownership, issuance rules, and lifecycle controls before access spreads across tools. The aim is to prevent separate identity silos from forming around each new platform.
👉 Read our full editorial: Infrastructure identity is the missing layer for resilient access